tdsds.com/gitea
1
1
Fork 0
mirror of https://github.com/go-gitea/gitea synced 2025-07-14 22:47:21 +00:00
Code Releases Activity

Reject star-related requests if stars are disabled (#33208)

Browse Source 
This PR fixes #33205.

If stars are disabled:
* The `.../repo/stars` page returns a 403 Forbidden error
* Star-related API endpoints return a 403 Forbidden error saying `Stars are disabled.`
* Same for action endpoints

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
Henrique Corrêa
2025-02-04 02:21:23 -03:00
committed by GitHub
parent a4676db7dd
commit d0f4e92563
6 changed files with 113 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

64
tests/integration/api_user_star_test.go
View File

@ -11,7 +11,9 @@ import (
auth_model "code.gitea.io/gitea/models/auth"
"code.gitea.io/gitea/models/unittest"
user_model "code.gitea.io/gitea/models/user"
"code.gitea.io/gitea/modules/setting"
api "code.gitea.io/gitea/modules/structs"
"code.gitea.io/gitea/modules/test"
"code.gitea.io/gitea/tests"
"github.com/stretchr/testify/assert"
@ -91,3 +93,65 @@ func TestAPIStar(t *testing.T) {
MakeRequest(t, req, http.StatusNoContent)
})
}
func TestAPIStarDisabled(t *testing.T) {
defer tests.PrepareTestEnv(t)()
user := "user1"
repo := "user2/repo1"
session := loginUser(t, user)
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadUser)
tokenWithUserScope := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteUser, auth_model.AccessTokenScopeWriteRepository)
defer test.MockVariableValue(&setting.Repository.DisableStars, true)()
t.Run("Star", func(t *testing.T) {
defer tests.PrintCurrentTest(t)()
req := NewRequest(t, "PUT", fmt.Sprintf("/api/v1/user/starred/%s", repo)).
AddTokenAuth(tokenWithUserScope)
MakeRequest(t, req, http.StatusForbidden)
user34 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 34})
req = NewRequest(t, "PUT", fmt.Sprintf("/api/v1/user/starred/%s", repo)).
AddTokenAuth(getUserToken(t, user34.Name, auth_model.AccessTokenScopeWriteRepository))
MakeRequest(t, req, http.StatusForbidden)
})
t.Run("GetStarredRepos", func(t *testing.T) {
defer tests.PrintCurrentTest(t)()
req := NewRequest(t, "GET", fmt.Sprintf("/api/v1/users/%s/starred", user)).
AddTokenAuth(token)
MakeRequest(t, req, http.StatusForbidden)
})
t.Run("GetMyStarredRepos", func(t *testing.T) {
defer tests.PrintCurrentTest(t)()
req := NewRequest(t, "GET", "/api/v1/user/starred").
AddTokenAuth(tokenWithUserScope)
MakeRequest(t, req, http.StatusForbidden)
})
t.Run("IsStarring", func(t *testing.T) {
defer tests.PrintCurrentTest(t)()
req := NewRequest(t, "GET", fmt.Sprintf("/api/v1/user/starred/%s", repo)).
AddTokenAuth(tokenWithUserScope)
MakeRequest(t, req, http.StatusForbidden)
req = NewRequest(t, "GET", fmt.Sprintf("/api/v1/user/starred/%s", repo+"notexisting")).
AddTokenAuth(tokenWithUserScope)
MakeRequest(t, req, http.StatusForbidden)
})
t.Run("Unstar", func(t *testing.T) {
defer tests.PrintCurrentTest(t)()
req := NewRequest(t, "DELETE", fmt.Sprintf("/api/v1/user/starred/%s", repo)).
AddTokenAuth(tokenWithUserScope)
MakeRequest(t, req, http.StatusForbidden)
})
}